{
  "_about": "CoreGuard recorded example — hand-authored illustration, NOT telemetry from a real Mac. See https://coreguard.app/incidents/silent-ssd-write-storm/",
  "incident": "silent SSD write storm",
  "process": "cloudsyncd (example)",
  "classification": "dangerous — and silent",
  "note": "Values are compressed onto one scrub of the timeline. No verdict, no failure date — CoreGuard observes and explains.",
  "clock_start": "13:00",
  "minutes_per_step": 2,
  "series": {
    "cpu_temp_c": [
      48,
      50,
      49,
      49,
      50,
      50,
      50,
      50,
      52,
      52,
      51,
      52,
      53,
      52,
      52,
      53,
      54,
      53,
      52,
      54,
      54,
      53,
      54,
      55,
      54,
      53,
      54,
      55,
      54,
      55,
      56,
      56,
      54,
      54,
      55,
      55,
      54,
      55,
      55,
      54,
      53,
      54,
      54,
      53,
      54,
      54,
      53,
      52,
      53,
      54,
      53,
      52,
      52,
      52,
      50,
      50,
      51,
      51,
      49,
      49,
      50
    ],
    "fan_rpm": [
      1400,
      1426,
      1450,
      1474,
      1500,
      1525,
      1549,
      1574,
      1601,
      1626,
      1649,
      1675,
      1700,
      1716,
      1733,
      1751,
      1768,
      1783,
      1799,
      1817,
      1833,
      1849,
      1867,
      1885,
      1900,
      1916,
      1933,
      1950,
      1966,
      1983,
      2001,
      1990,
      1977,
      1966,
      1956,
      1945,
      1933,
      1923,
      1912,
      1900,
      1888,
      1878,
      1867,
      1855,
      1844,
      1834,
      1822,
      1810,
      1800,
      1772,
      1742,
      1712,
      1684,
      1655,
      1624,
      1595,
      1567,
      1538,
      1508,
      1479,
      1450
    ],
    "write_mb/s": [
      2.0,
      3.4,
      2.6,
      2.0,
      2.8,
      3.0,
      2.1,
      32.2,
      63.4,
      92.8,
      94.0,
      96.8,
      100.0,
      101.8,
      104.1,
      108.1,
      111.2,
      109.3,
      108.3,
      108.8,
      108.3,
      107.2,
      107.6,
      108.3,
      106.8,
      105.1,
      105.4,
      105.7,
      104.5,
      104.2,
      105.0,
      104.3,
      102.2,
      101.9,
      102.7,
      102.1,
      101.0,
      101.5,
      101.5,
      99.6,
      98.5,
      99.4,
      99.5,
      98.3,
      98.0,
      75.4,
      51.0,
      26.2,
      3.6,
      4.7,
      4.0,
      3.2,
      3.8,
      3.6,
      2.0,
      1.9,
      3.4,
      3.3,
      2.1,
      2.1,
      2.5
    ]
  },
  "process_metric": {
    "label": "WRITE MB/s",
    "unit": "MB/s",
    "max_scale": 150
  },
  "events": [
    {
      "minute_index": 8,
      "clock": "13:16",
      "kind": "observed",
      "text": "a sync helper starts hammering the SSD with writes"
    },
    {
      "minute_index": 16,
      "clock": "13:32",
      "kind": "observed",
      "text": "fans barely move, temps stay cool — nothing SOUNDS wrong"
    },
    {
      "minute_index": 24,
      "clock": "13:48",
      "kind": "alert",
      "text": "CoreGuard write-anomaly warning: cloudsyncd (example) wrote ~200 GB in about half an hour — far above its usual rate"
    },
    {
      "minute_index": 34,
      "clock": "14:08",
      "kind": "interpreted",
      "text": "silent endurance burn: no heat, no noise — only the write counters see it happening"
    },
    {
      "minute_index": 47,
      "clock": "14:34",
      "kind": "observed",
      "text": "the storm ends — roughly 480 GB written, about +0.1% of rated endurance in one afternoon"
    },
    {
      "minute_index": 56,
      "clock": "14:52",
      "kind": "interpreted",
      "text": "the (Pro) per-app write timeline keeps the whole afternoon on record, and the years-left estimate adjusts. The warning itself? Always free."
    }
  ]
}